GDPR and EU Data Protection: Challenges for retailers

By Deborah L. Weinswig

Retailers have access to a huge amount of consumer data thanks to digital technology, and consequently are exposed to the risk of breaching data protection regulations.

Companies operating in the European Union (E.U.) need to comply with E.U. legislation on data protection. This report provides an overview of the latest E.U. legislation that will come into force in May 2018 – the General Data Protection Regulation (GDPR) – and its implications for retailers, and suggest how retailers can prepare for the new regime.

This report touches on these main points:

• Companies targeting consumers based in the E.U. are currently subject to the E.U. Data Protection Directive that will be replaced by the more restrictive GDPR in 2018.

• The GDPR introduces significant changes in the level of data protection. For example, the new regulation makes it easier for individuals to bring claims against companies processing data.

• Retailers targeting E.U. consumers will need to prepare to comply with the new regulation, even if they are based outside the E.U. – for example, by training staff on compliance and by setting up clear accountability procedures.

Introduction
Retailers have access to a huge amount of consumer data thanks to the application of digital technology to their operations.

For example, shoppers visiting online stores leave a digital footprint of their shopping behavior, and even those going to bricks-and-mortar stores leave traces when retailers use technologies such as radio frequency identification (RFID) or near field communication (NFC) to engage with shoppers.

This access to valuable consumer data is a great opportunity for retailers to better understand their customer base and to provide better service. However, the flipside of this is the responsibility that comes with the handling of personal data.

In particular, retailers that deal with consumers based in the E.U. need to consider the implications of the E.U. provisions that regulate data protection. The matter is currently regulated by the 1995 E.U. Data Protection Directive, but a new regulation – the General Data Protection Regulation (GDPR) – that goes into effect on May 25, 2018, will introduce more stringent provisions for organizations processing consumer data.

This report provides an overview of the new legislation, its key changes compared to the current directive and the implications of the new data protection regulation for the retail industry, as well as shows how retailers can prepare and respond to the more stringent regulatory provisions.

The Data Protection Directive: Background of the current legislation
In the E.U., privacy and data protection are currently regulated by the Data Protection Directive (DPD), adopted in 1995. The Directive states that data processing is only lawful if the data subject – the individual whose data is collected – has unambiguously given consent.

The E.U. Directive was implemented by national parliaments of the member states. In the United Kingdom, the DPD was implemented through the Data Protection Act 1998 (DPA).

For clarity, we briefly consider how retailers are subjected to the DPA’s provisions.

The DPA regulates the processing of personal data by two stakeholders, which are identified as:

• Data controller: The person (physical or legal) who determines the purpose for processing personal data and the way data are processed.
• Data processor:The person who processes the data on behalf of the data controller.

Data controllers and data processors can be companies processing their own customers’ data.

In most cases, data controllers and processors are part of the same organization – the two functions are often assigned to different departments within the same company.

The data controller can be a retailer collecting customers’ data using RFID technology. The collected data could be processed by the retailer itself or by a third-party company to which the retailer has subcontracted the function.

Under the DPA, data controllers handle personal data according to a series of key principles. For example, they must process data fairly and lawfully, for specified purposes, and they are obliged to keep the data secure and only for the necessary period, and to not transfer the information outside the E.U. without adequate protection.

The DPA gives the entire responsibility for compliance to the controller, who must ensure that the processor complies with the principles. Failure to comply can result in penalties and even criminal prosecution for the controller.

How the use of RFID is regulated by the E.U.
RFID devices are used by retailers for customer engagement. The European Commission released the E.U. Regulatory Technical Standards in 2014 to help companies using RFID comply with E.U. data protection rules laid out in the 1995 Data Protection Directive.

According to the Regulatory Technical Standards, retailers should:

1. Give consumers clear and simple information on what type of data will be collected and how their data will be used and for what purpose.
2. Provide clear labeling to identify the devices that collect the data.
3. Conduct privacy and data protection impact assessments before using RFID devices.

RFID. Image credit: Europa.eu

Introducing the General Data Protection Regulation
The new GDPR, adopted in 2016, will replace the E.U. Data Protection Directive and the related national acts such as the U.K. DPA when it comes into force on May 25, 2018.

The GDPR introduces a stricter data protection compliance regime and puts direct obligations on processors for the first time.

Moreover, the Directive enables consumers to enforce their rights against firms processing data and facilitates the application of tougher sanctions on noncompliant companies.

Businesses targeting European consumers will need to prepare to comply with the new regulation, even if they are based outside the E.U., as the regulation applies to the treatment of data belonging to E.U. subjects, regardless of where the data controller and processor are based.

Unlike the current DPD, the GDPR will be enforced directly in the E.U. member states, without the need for legislative intervention by national parliaments. In this way, the GDPR will limit the possibility of diverging interpretations of the regulation in different jurisdictions.

Brexit will not make British-based firms exempt from the GDPR, given that it will be enforced prior to the date when negotiations between the U.K. and the E.U. end. The most optimistic deadline is two years from March 2017, when Article 50 was triggered by British Prime Minister Theresa May.

Even after the U.K. exits the E.U., British companies targeting E.U. consumers will still need to comply, given the extraterritoriality of the GDPR.

The text of the GDPR explicitly states its application to the processing of personal data of data subjects related to the offering of goods and services or the monitoring of their behavior.

Moreover, the text mentions that online identifiers such as RFID tags can be used to profile a person, thereby creating the case for the application of data protection principles to the use of RFID technology.

RFID tag on apparel. Image credit: iStockphoto

The GDPR does not significantly change the data protection principles as listed in the previous Directive.

According to the GDPR, personal data must be processed lawfully, fairly and transparently, collected accurately and safely, and stored with a specific purpose in mind. The controller is responsible for and must be able to demonstrate compliance with the data protection principles.

The GDPR also requires processors to comply with certain obligations, such as maintaining adequate documentation, and will be directly liable to sanctions if they fail to meet these criteria.

However, the GDPR presents significant changes in the level of data protection and is a big step up from the provisions of the current DPD. Figure 1 summarizes the key changes and possible implications for retailers using RFID.

GDPR: Key changes and potential impact on retailers using GDPR. Image credits: Europa.eu/DLAPiper.com

How retailers can prepare for the GDPR
The GDPR entails a significant increase in accountability in terms of data protection and in administrative burden for retailers processing customers’ data.

However, I do not think that the GDPR will put at stake retailers’ abilities to take advantage of consumer data, as long as companies take action to prepare for the new regulation.

In particular, retailers should:

1. Analyze the legal basis on which data are used:Understand whether the use of the tracking technology falls under the provisions of the GDPR. For example, some uses of RFID can be considered as tracking product movements in-store, rather than customer behavior. In those cases, the use of RFID could be exempted from the regulation.
2. Review strategies for data processing and recording: Review and enhance the procedures used to track records of data-processing activities and ensure that appropriate documentation is kept.
3. Set up clear compliance accountability procedures:Given that different divisions in an organization will have greater accountability, it is important to set precise procedures that assign clear responsibilities within the company.
4. Train staff on data protection:The increased accountability within different divisions of a company exposes more staff to the responsibility of compliance and requires that employees not previously involved be adequately trained.
5. Review the use of subcontractors:When choosing a data collector that is a third-party organization, it is important to appoint a company that can ensure compliance.
6. Prepare for data breaches:Set up an efficient notification system and put in place clear procedures to ensure a fast reaction to data breaches.
7. Prepare for data subjects’ claims:Prevent claims from customers by setting up clear and explicit data consent policies, and prepare for customers to exercise their rights with procedures that ensure effective responses.
8. Understand which regulators have jurisdiction over international operations: It is important for retailers that operate internationally to determine which authorities have jurisdiction over data-processing activities in different countries.

Key takeaways
Retailers have access to a huge amount of customer data thanks to the application of digital technology to their operations. But while this is an opportunity to better understand the customer base, the broader availability of personal data exposes companies to the risk of breaching data protection regulations.

In the E.U., privacy and data protection are currently regulated by the Data Protection Directive, but the GDPR will replace the current legislation when it comes into force on May 25, 2018, and will introduce a stricter data protection compliance regime.

The GDPR introduces significant changes in the level of data protection.

For example, the new regulation makes it easier for individuals to bring claims against companies processing data.

RETAILERS TARGETING European consumers will need to prepare to comply with the new E.U. regulation, even if they are based outside the E.U., for example, by training staff on compliance and by setting up clear accountability procedures.

I believe that companies that prepare well for the GDPR will not jeopardize their ability to take advantage of the insight provided by consumer data despite the more restrictive regime that they will face.

Please click here for easy access to the entire E.U. GDPR documents (courtesy of intersoft consulting services)

Deborah L. Weinswig is founder/CEO of Coresight Research

Deborah L. Weinswig is founder/CEO of Coresight Research, Hong Kong. Reach her at deborahweinswig@fung1937.com.